I might have missed a post, and I apologize if I have, but didn't I read
the original poster has "a drive" where there's a directory with
EFS-encrypted files? Is this an image or a copy of the original drive?
I guess I got lost where the system disk was wiped, but he/she has a
drive ...

How did this directory with these EFS-encrypted files get to this other
drive?

If we know more we might be able to offer more assistance.

regards,

farmerdude

On Tue, 2007-01-02 at 12:39 +0530, Chetan Gupta wrote:
> Dear Richard,
>
> You could try EFS key from Passware but to retrieve the files, the
> encryption password must be known or SAM database must be present.
>
> There is also Advanced EFS Data Recovery from Elcomsoft available at
> http://www.elcomsoft.com/aefsdr.html
> But again it requires the EFS key to be present or the user password and
> syskey to be known to the user.
>
> HTH
>
> Chetan Gupta
>